IR 05000312/1982008
| ML20054J326 | |
| Person / Time | |
|---|---|
| Site: | Rancho Seco |
| Issue date: | 05/17/1982 |
| From: | Canter H, Obrien J, Thomas Young NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION V) |
| To: | |
| Shared Package | |
| ML20054J323 | List: |
| References | |
| 50-312-82-08, 50-312-82-8, NUDOCS 8206280494 | |
| Download: ML20054J326 (11) | |
Text
-
.
.
U. S. NUCLEAR REGULATORY COMMISSION
REGION V
I Report No.
50-312/82-08 Docket No. 50-312 Licens< No. DPR-54 Safeguards Group Licensee: _ Sacramento Municipal Utility, District P. O. Box 15830 Sacramento, California 95813
'
Facility Name:
Rancho Seco Unit 1 Inspection at:
Herald, California (Rancho Seco Site)
Inspection conducted:
Special:
February 11, 1982 through March 10 & April 28, 1982 Q M L(
-
[~ / 7' d Inspectors:
Harvey L. Canteri S~enior R igntIn/pector Date Signed h'
'U)/Wl
$Y~
l
.
John O'Br;en, Uni leside I
ectorg/
Date Signed Approved by:
A W
M k k, h T. Young, Chief React
~ Project Sect n2 Date Signed Reactor Operations rojects Brinch Sumary:
Inspection between February 11 and March 10, 1982 & April 28, 1982
[ Report 50-312/82-08)
Areas Inspected:
Special unannounced inspection of two events with safety significance:
LER 82-05 on the "B" Diesel Generator Inoperability and LER 82-03 on the "B" High Pressure Injection HPI Pump inoperability. The inspection activities involved 51 inspector hours by the resident inspectors.
Resul ts: Two Severity Level III items of noncomoliance were identified.
Thb two result from violating license conditions associated with diesel nenerator and HPI pump operability.
8206280494 820608 PDR ADOCK 05000312 O
_ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _
.
.
DETAILS 1.
Persons Contacted
- +R. Rodriguez, Manager, fluclear Operations
- P. Oubre', Plant Superintendent
+0. Blachly, Operations Supervisor
,
+ E. Bradley, Emergency Plan Coordinator N. Brock, Electrical /I&C Maintenance Supervisor D. Cass, Mechanical Maintenance Supervisor
- +R. Colombo, Technical Assistant
- +G. Coward, Maintenance Supervisor
- +S. Crunk, Associate fluclear Engineer
- J. Dawson, Quality Control Coordinator
+R. Fraser, Mechanical Engineer
- +R. Miller, Chemistry / Radiological Supervisor
- +T. Perry, On-site Quality Assurance Supervisor
- +L. Schwieger, Quality Assurance Director
-
+F. Sheehan, Assistant Electrical Engineer B. Spencer, Acting Operations Supervisor T. Tucker, Planner / Scheduler
- +W. Wells, Senior Administrative Assistant
- +D. Whitney, Engineering and Quality Control Supervisor
- R. Wichert, Mechanical Engineer The inspectors also talked with and interviewed several other licensee employees, including members of the engineering, maintenance, operations, and quality assurance (QA) organizations.
- Denotes those attending the Exit Interview on February 26, 1982.
+ Denotes those attending the Exit Interview on March 10, 1982.
2.
Background In April 1980, the NRC issued an order modifying the Rancho Seco Operating License. This order required that:
... administrative procedures be adopted and implemented to reautre independent verification of valving lineups and equipment operability whenever safety-related equipment is removed from or placed into service...
The events described in this special inspection report relating to the inoperability of the "B" diesel generator and the "B" HPI Pump were examined very closely for possible non-compliance with the April 1980 order. After a detailed scrutiny of the procedural controls and associated records for these two events, it appears that the requirements of the order pertaining to independent verification had been satisfied.
In both cases the procedures in place accurately specified the requirements for independent verification. Additionally, the record of accomplishing the independent verification (i.e the checklist included in the procedure) indicates that two individuals did independently complete the checklists.
_ _.. _..
.
.
.
-2-Based on the above it appears that both the diesel generator and the HPI pump inoperabilIty resulted from inadequate procedures and procedural implementation rather than a failure to comply with the April 1980 NRC order requiring independent verification.
3.
Licensee Event Report (LER) Follow-up The Resident Inspectors performed an examination of the folicwing licensee event reports because it wa: determined that additional inspection effort was necessary to ascertain the safety significance of these events, a.
LER 82-05 (OPEN):
Inoperable "B" Diesel Generator On February 11, 1982, the licensee informed the Resident Inspectors that the "B" Diesel Generator was found to be inoperable because of an energized fault relay in the output breaker closing circuit.
This event is reportable as a 30-day LER. The report was received on March 17, 1982. The Reactor was operating at 100 percent, Power (940 MWe) during this event.
The following documents were examined as part of the follow-up inspection on this event:
1.
Reportable Occurrence Report (AP-22) (2/11/82)
11.
Work Request 58112 for the "B" Diesel Generator (. Initiated on 12/18/81)
111.
Shift Supervisors Logs (2/9/82, 2nd Shift to 2/11/82, 3rd Shift)
iv.
Control Operators Logs (2/9/82, 2nd Shift to 2/11/82, 3rd Shift)
v.
LER 81-33 (7/3/81)
vi.
Auxiliary Building Logs (2/8/82 to 2/11/82)
vii.
Technical Specification Sections 1.9.2 and 3.7.2 viii.
Operating Procedure A.31, Diesel Generator System, Rev. 9 ix.
Surveillance Procedure SP206.03B, Monthly D/G "B" Test, Rev. 11 Computer log typer information (2/9/82 to 2/11/82)
x.
,
I f
.
__
.
l*
l-3-xi.
Administrative Procedure 23, Control Room Watchstanding, Rev. 9 xii.
Annunciator Procedure H2ES, Rev. 2 xiii.
IE Inspection Report 50-312/80-06,(4/4/80)
xiv.
Response to IE Report 50-312/80-06 (4/23/80)
xv.
NRC Order Modifying License DPR-54 (4/1/80)
xvi.
Administrative Procedure AP-3, Work Request, Rev. 22 xvii.
Work Request 61005 for Troubleshooting of "B" Diesel trouble alarm (Initiated 2/11/82)
xviii.
Data sheets for monthly surveillance test of
"A" Diesel Generator (2/9/82)
xix.
Data sheet for monthly surveillance test of the "B" Diesel Generator (2/10/82)
,
xx.
Plant drawings (P& ids) E-208 (sheet 36, Rev. 7) and E-204 (sheet 2, Rev. 12)
xxi.
LER 79-11 (9/13/79)
The following facts were detennined during the inspection:
(1) The monthly surveillance on the "A" Diesel = Generator was run between 6:39 p.m. and 9:29 p.m. on February 9, 1982.
(The A" Diesel Generator was shut down at 8:49 p.m.).
(2) The monthly surveillance on the "B" Diesel Generator was
'
~
(The run between 5:51 a.m. and 9:04 a.m. on February)10, 1982.
"B" Diesel Generator was shut down at 8:29 a.m.. During this test, the "B" Diesel Generator Room Supply Fan failed to start.
(3) Work Request 58112 which was initiated in December 1981, was opened at 7:50 a.m. on February 10, 1982, for work on a
"B" Diesel Generator pressure switch (PSL-88638). This work did not effect the diesel's operability, but was work taking place during the event.
(4) The "B" Diesel Generator was run for a few minutes on February 10, 1982 (between 1:15 p.m. and 1:18 p.m.), but it was not loaded.
This start was performed to test the pressure switch mentioned above, and to test the Diesel Generator Room %pply Fan.
The fan did start at this time.
..
.
d
-. -
_ _. _
h
_
_a
.
.
.
-4-(5) When the "B" Diesel Generator was secured on February 10, 1982, at 9:04 a.m., the "B" Diesel Trouble alarm came on in the Control Room. The Shift Supervisor and Control Room Operators later said that this alarm was believed to oe due-to the fact that there was a high fuel filter differential pressure alarm on the Engine Control Panel in the "B" Diesel Generator Room. However, this problem would not have prevented the diesel from starting or prevented the output breaker from closing.
(6) During the morning of February ll,1982, the faulty "B" Diesel Room Supply Fan was repaired. Also, the diesel fuel filters were replaced during this time frame. After this work was completed, the "B" Diesel Trouble alarm was still lit in the Control Room.
(7) The Shift Supervisor then requested that the electrical maintenance group investigate the possible annunciator-problem.
Prior to 1:30 p.m. on February 11,1982, the electrical maintenance personnel found that the fault flag 432 (on the 486 reverse current relay) was dropped on the "B" Diesel Generator Output Breaker, 52-4B11. According to discussions with electrical technicians, this fault flag could have been caused by improperly unloading the diesel generator the last time it was paralleled to the 4B bus.
In other words, the 486 relay was energized from a reverse power trip. The "B" Diesel Generator was declared inoperable at 1:30 p.m.on February 11, 1982.
.
(8) This tripped relay would have prevented the "B" Diesel Generator Output Breaker from closing.
-
,
.
(9)
Item 8 was confirmed by actions the shift supervisor.took ' f after declaring the "B" Diesel inoperable. He told the'
inspector that an attempt was made to close the "B" Diesel:
Generator Output Breaker from the Control Room, but it.did not close. After pushing the " trip" push button on panel H2ES in the Control Room, the "B" Diesel Trouble alarm cleared'
indicating that the reverse current fault relay was reset. At-1:40 p.m. on February 11, 1982, the'"B". Diesel was started.
The operators paralleled the "B" Diesel' to the 4B bus and performed the "B" Diesel Monthly; Surveillance'successfully.
This diesel was secured at 6:15. pm on February 11, 1982.
'
(10) The "A" Diesel Generator Surveillance Test was also run
'
and apparently completed successfully at 10:10 p.m. on February 11, 1987
>
,
e
.
.
5-(11) A review of the operator's logs for the Auxiliary Building showed that the fault flag in question;for the 4B Switchgear was checked each shift between February 8, 1982, and February 11, 1982, with no discrepancies noted. These logs were initiated in response to a similar occurrence' described in LER 79-11.
(12) Procedure A.31 deccribes the method operato'rs are to use to secure a diesel.
Section 6.1.4 states, "With diesel generator load at 50KW open diesel generator output breaker...
(4B11)." The operator who secured the diesel on February 10, 1982, stated that he feels he opened the breaker by pushing the " trip" button on the H2ES panel in the control room.
If this were the case, the 486 relay would probably not have energized and the fault flag 432 would not have dropped.
Ifthe breaker had opened on his command, the sensing circuit for the 486 relay would no longer be in the circuit.
If he operated the push button after the relay was energized, the relay would have reset as it did on february 11, 1982.
(13) Procedure A.31 also describes what is to be done to ensure that the diesel generator is in standby.
Section 6.1.9 states, " Ensure that diesel generator...(b) is in a standby condition as per Section 4.1 and Enclosure...(8.12) of this procedure." Section 4.1.33 states " Rack in breaker... (4B11).
Check relays on local panels clear of all targets...."
The procedure gces on to require a local check of all panels to make sure all alarms are clear.
It also requires a clear alarm panel in the Control Room' including the Diesel Generator Trouble alarm. These actions were not documented.
(See Item 16 below.)
(14) Annunciator Procedure H2ES directs the operators on what actions to take when a Diesel Trouble alann exists.
The operators assumed that the trouble alarm was being caused by the high d/p on fuel oil filter so this procedure was not used.
(15) On July 3,1981, the licensee report.ed a similar event in LER 81-33. A dropped fault flag and an opened relay (not the reverse relay current) caused the "A" Diesel Generator to be inoperable. The operators apparently failed to identify the " dropped flag" condition at that time also.
That fault relay prevented the "A" Diesel from starting.
For corrective action, the licensee moved the annunciator function for that open relay condition to the " Diesel Not Ready for Auto Start" annunciator in the Control Room because of its disabling function.
LER 81-33 also
,
,
'. -
.
-6-l discusses further corrective action; it committed to investigate different relay marking techniques to find the best available. After this event, on February 10, 1982, the licensee added white square box markings to the glass cover over the target location which emphasizes the location of the targets. These were not in place during this event.
(16) The function of the " Diesel not ready for auto start" alarm is to alert the operators that the diesel generator sub-system is not operational. The function of the " Diesel trouble" alarm is to alert the operator of non-disabling conditions that require operator attention.
During this event the reverse current relay annunciator function was connected to the " Diesel Trouble" alarm.
It should have been connected to the " Diesel not ready for auto start" alarm because it is a diesel subsystem disabling alarm.
(17) Technical Specification 3.7.2 specifies that the reactor shall not remain critical unless, among other things, the.
,
following concondition is satisfied: "Both diesel generators shall be operable except that from and after the.date that.'
one of the diesel generators is made or found to be inoperable for any reason, reactor operation is permissible
~
for the succeeding fifteen days provided that during.such fifteen days the operable diesel generator shall be load
~ '
tested daily...."
,
_
'
(18) Technical Specification 1.9.2 defines " daily" as,."a time' '
.
~
period spaced to occur at least once per twenty-four (24)
hours."
%
a
,
(19) Surveillance Test Procedure SP206.03B, Monthly D/G Surveillance Test Procedure, Step 4.2.23, requires independent verification before returning the "B" diesel generator to the standby mode. The independent verification specified by the checklist was performed but the checklist did not include reference to the fault flag on the reverse current relay.
_
,
Based on the above facts, it appears that the "B" Diesel Gerierator was unable to meet its safety function from 8:29 a.m. on February 10, 1982, to 1:40 p.m. on February 11, 1982.
b.
LER 82-03 (OPEN) Inoperable "B" High Pressure Injection Pump (HPI)
On March 2, 1982, the licensee informed the Resident Inspectors that the "B" HPI pump was found inoperable because the pump was improperly returned to standby following maintenance. This
_ _ _ _ _ _ _ _ - _ _ _ - _ _ _ _ _ _ _ _ _ _.
'
,.
-7-was reported as a 24-hour report with a 14-day follow-up report received on March 23, 1982. The Reactor was operating at 57 percent power (545 MWe) during this event.'
The following documents were examined as part of the follow-up inspection on this event:
1.
Reportable Occurrence Report (AP-22) (3/1/82)
11. Auxiliary Building Logs, Sheet 9 (2/26/82 to 3/1/82)
iii. Control Room Logs (2/26/82, first shift to 3/2/82, second shift).
iv. Shift Supervisors Logs (2/26/82, second shift to 3/1/82, second shift)
v.
Work Request 61173 for. the "B" HPI Pump (Initiated on 2/24/82)
vi. Work Request 61174 for the "B" HPI Pump Auxiliary Lube Oil Pump (Initiated on 2/24/82)
vii. LER 50-312/82-03 (3/2/82, 24-hour notification)
viii.0perating Procedure A.15, Makeup, Purification and Letdown System, Rev. 13 ix. Surveillance Procedure SP203.02M, HPI Inspection and Surveillance Test, Rev. O x.
Ads nistrative Procedure 23, Control Room Watchstanding, Rev. 9 xi. Technical Specification 3.2 and 3.3 xii. I.E. Inspection Report 50-312/80-06 (4/4/80)
xiii. Response to I.E. Report'50-312/80-06-(4/23/80)
xiv. NRC Order Modifying License DPR-54 (4/1/80)
xv.
SP203.02M (completed on 2/26/82)
xvi SP203 02H, Enclosure 6.1, Monthly "A" H.P.I. Vent Surveillance data sheet (2/26/82)
xvii.SP203.021, Enclosure 6.1, Monthly "B" H.P.I. Vent Surveillance data sheet (2/26/82)
xviii.0perating Procedure A.58, 4.16 KV Electrical System xix. LER'79-11 (9/13/79).
xx.
AP.4, Administrative Clearance Procedure The following facts were determined during the inspection:
(1) The "B" HPI pump was taken out of service for maintenance at 9:00 a.m. on February 26, 1982.
(2) The licensee changed. oil in the "B" HPI pump and it was returned to service at 12:30 p.m. on February 27, 1982. The delay in returning the pump to service was due to the Shift Supervisor not having a completed work request. The reason for the oil change was stated on Work Request 61173 to be
.that the pump's oil "...looks as if it is mostly water."
-
.-
,
I
- _ _ - _ _ _ _ _ _ _ - _ _ _ _ - _
_ _ _
.-
-8-(3) According to the operator who placed the "B" HPI pump out of service, he racked out its supply breaker in accordance with the procedures he had been taught. Thissincluded. securing power to the DC charging spring motor. This motor provides the motive force to maintain the charging springs charged.
The charging springs store enough energy to close and trip the breaker one time each. The supply breaker was racked out on February 26, 1982, about 9:30 a.m.
(4) The operator who racked in the breaker on February 26, 1982, at about 5:15 p.m. and returned the pump to service stated that he did not check to see that the power was restored to the DC charging spring motor. He informed the inspector that to the operator's knowledge, "no one ever touches that switch." Procedure A.58 requires *the operator to verify that the disconnect switch is closed before racking the breaker in to the connect position.
(5) An initial condition for the performance of SP203.02M, HPI Inspection and Surveillance Test, is that the normal supply breaker for the "B" HPI pump be lined up in accordance with operating procedure A.58.
Procedure A.58 requires one to check the condition of the operating springs and the motor disconnect switch.
~
(6) A surveillance test of the "B" HPI pump was apparently performed in accordance with operating Procedure A.15 and Surveillance Procedure SP203.02M, and was completed successfully at 7:45 p.m.
on February 26, 1982. Since the charging spring is a stored energy device, it only had sufficient energy to operate the breaker one time. The charging spring was discharged by the performance of the surveillance test. At this point the
"B" high pressure injection pump became inoperable.
It was on February 26, 1982, at 7:05 p.m. that the pump was stopped.
(7) The Makeup Pump was out of service due to a failed motor and has been out of service since the first week of October i
1981 and remained out of service during the entire period of concern. The licensee was therefore left with only one operable high pressure injection train during this event.
(8) The licensee continued operation, and failed to identify the " discharged" condition of the 4B supply breaker. The Auxiliary Building logs indicate that the operators checked the proper position of the disconnect switch and the discharged condition of the charging spring each shift during its inoperability.
However, they failed to identify the switch being in the off position or that the spring was discharged.
These logs were initiated in respense to a similar occurrence described in LER 79-11.
-~
~
-
,
A e
$
( 6 4 +*
F
-
- _ _ _ _. - _ _ _ _. _
_ _ _ _
'
'
..
-9-(9) On March 1,1982, at about 1:17 p.m. the licensee attempted to start the "B" HPI pump.
It failed to start.
(10) Investigation by a Senior Reactor Operator on shift revealed that the charging spring was discharged and its motor was off.
He re-energized the motor and the charging spring recharged.
(11) At 1:25 p.m. on March 1,1982, the licensee started the "B" HPI pump and verified its operability.
(12)Thechargingspringmotordisconnectswitchisamechanical switch, and its position is not annunciated in the Control Room or on the pump's local control panel. One has to open the outer door to the breaker and look at the switch to determine if it is in the proper position.
(13) Technical Specification 3.2.1 specifies that the reactor shall not remain critical unless two pumps capable of supplying high pressure injection are operable.
(14) Technical Specification 3.3.1.A also specifies the reactor shall not remain critical unless two out of the three high pressure injection pumps are operable.
(15) Technical Specification 3.3.2 states:
" Maintenance shall be allowed during power operation on any component (s) in the high pressure, low pressure, nuclear service cooling and raw water cooling, Reactor Building. spray, or Reactor Building emergency cooling systems, the core flooding system pressure instrument channels or BWST level channels, which will not degrade Safety Features System A or B below the level of performance with the single sybsystem removed from service.
In the context of this specification, a Safety Features System consists of the following subsystems: high
.
~
pressure injection, low pressure injection, Reactor-
~
Building emergency air cooling, Reactor Building spray, diesel generator, nuclear-service cooling. water and nuclear service raw water.
If the system being repaired is not restored to meet the requirements of specification 3.3.1 within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, the reactor shall be placed.-
in a hot shutdown condition:within~ 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />'s.' If the~
requirements of specification 3.3.1 are not met within an additional 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, the-reactor shall be placed
,
in a cold shutdown condition within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />."
,
'.
.
l
- . *
.
.
-10-
-
.
(16) Operating Procedure A.58, 4.16KV System, Step'4.7, requires the operator to " verify the motor disconnect switch is closed" before the breaker is racked to the connect position.This ;,
'
step was omitted by the operator.
sl'
_
(17) Operating Procedure AP.4, Administrative ClearaAce -Procedure, Step 4.1.5, requires independent verification by two individuals when lifting a clearance and returning the HPI.to' standby.
This function was performed by'two individuals but the checklist did not include a check of the. motor disconnect switch.
With the above facts, it appears that the
"B" High Pressure Injection Pump was made inoperable at 7:05 p.m. on. February 26, 1982, and continued in that condition, with only the "A" High Pressure Injection Pump operable, until 1:17 p.m. on March 1,1982.
The results of the inspector's review of these two LERs indicates a breakdown in the control of licensed functions.
Proper implementation of routine shift surveillance practices should have detected the conditions soon after they occurred. Based on the above, these events are classified as Severity Level 3 Violations (Supplement I) (82-08-01).
No other items of noncompliance or deviations were determined to exist during this inspection.
4.
Exit Interview The inspectors met with licensee representatives in exit meetings on February 26 and March 10, 1982. During the February 26, 1982 meeting, the inspectors described the Diesel Generator event'as a possible violation. At the March 10, 1982 meeting, the inspectors explained that this Special Inspection Report will document the Diesel event and the Hi h Pressure Injection Pump event.
(See Paragraph I for attendees.
Also, at the March 10, 1982 meeting, the inspectors discussed the scope of their findings on the apparent violations. The licensee acknowledged the inspector's findings, and further comitted to an engineering review of the four Control Room diesel annunciators (.two
" Diesel Trouble" and two " Diesel Not Ready For Auto Start") to determine if they indicate the appropriate status of the diesel generators and their output breakers.
,
I t
- *